High Severity
CVE-2026-13043
Published: Oct 25, 2026
CVE-2026-13043 - Exploiting Panda / WatchGuard pskmad.sys authentication bypass for privileged IOCTL access, MSR disclosure and arbitrary process memory reads.
# ***🕷️ CVE-2026-13043 - Panda / WatchGuard Kernel Memory Access Driver Vulnerability***
<p align="center">
<img src="Images/Logos/CVE_2026_13043.png">
</p>
<p align="center">
<i>
Panda / WatchGuard pskmad.sys authentication bypass - privileged IOCTL access, MSR disclosure and arbitrary process memory read through a signed kernel driver.
</i>
</p>
---
---
---
## ***📑 Table of Contents***
- [Overview](#Overview)
- [Background](#Background)
- [Bring Your Own Vulnerable Driver](#BYOVD)
- [The Driver](#TheDriver)
- [The Vulnerability](#TheVulnerability)
- [Authentication Mechanism](#Authentication)
- [IOCTL Interface](#IOCTLInterface)
- [How It Works](#HowItWorks)
- [Phase 1 - Load the Vulnerable Driver](#Phase1)
- [Phase 2 - Open Device Handle (Handshake Bypass)](#Phase2)
- [Phase 3 - MSR Read (KASLR Defeat)](#Phase3)
- [Phase 4 - Arbitrary Process Memory Read](#Phase4)
- [Impact](#Impact)
- [Affected Versions](#AffectedVersions)
- [Build](#Build)
- [Usage](#Usage)
- [Lab Setup](#LabSetup)
- [References](#References)
---
---
---
<div id='Overview'/>
## ***Overview***
This repository provides an educational breakdown of [CVE-2026-13043](https://psirt.watchguard.com/CVE-2026-13043), a critical missing authentication vulnerability in the Panda Kernel Memory Access Driver (`pskmad.sys`) shipped with WatchGuard and Panda endpoint security products.
The driver exposes a device interface (`\\.\PSMEMDriver`) with privileged IOCTL handlers designed to support the antivirus engine's memory inspection operations. In theory, only authorized Panda components should be able to reach those handlers - the driver gates access behind a challenge/response handshake. In practice, every piece of that handshake is reproducible: the named objects are caller-created, the challenge contains only public constants, and the expected response is a single hard-coded value. Any local administrator can forge the exchange, obtain a device handle, and talk directly t